Data protection method and system for content generated by artificial intelligence

Abstract

The invention relates to the technical field of data processing, and discloses a data protection method and system for content generated by artificial intelligence. The method comprises the following steps: carrying out three-level treatment of sensitive knowledge discovery, grading and desensitization on an original corpus; a dynamic forgetting mechanism is introduced in the model training stage; a bidirectional streaming security gateway is deployed in the reasoning stage; embedding an invisible semantic watermark into the finally generated content; recording information such as watermark hash through the side chain of the block chain; and an edge calculation white box is adopted in a terminal display link. The system comprises a data management subsystem, a model training subsystem, a bidirectional streaming security gateway, a semantic watermark embedding subsystem, a block chain auditing subsystem and an edge white box playing subsystem. According to the technical scheme, full-link privacy protection can be realized, the safety of the reasoning process is improved, the robust traceability is provided, the terminal display compliance is ensured, large-scale deployment is supported, and the operation and maintenance efficiency is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data processing, and particularly relates to a data protection method and system for artificial intelligence generated content. BACKGROUND

[0002] With the wide application of artificial intelligence generated content (AIGC) technology, it not only improves the content production efficiency, but also causes increasingly serious data security and privacy protection challenges. The AIGC system usually relies on massive corpus for training, and dynamically responds to user instructions in the inference process. This characteristic makes it a high-risk carrier of sensitive information leakage, malicious prompt injection and generated content abuse. At present, data security governance has evolved from traditional static desensitization to dynamic protection in the whole life cycle, covering data cleaning before training, privacy protection during training, content filtering during inference, and traceable mechanism after generation, etc. multiple dimensions, which constitute the core foundation of AIGC trusted service.

[0003] Among them, the data protection of artificial intelligence generated content focuses on building a security closed loop covering the whole link of "data-model-output-terminal". This direction aims to integrate differential privacy, dynamic forgetting, real-time interception, invisible watermarking and blockchain auditing, etc. multi-dimensional technical means, while protecting the performance of the model, effectively blocking the leakage path of sensitive information, and realizing accurate traceability and responsibility identification of illegal behavior.

[0004] The existing technology still has significant defects in dealing with AIGC data security problems: first, the data governance before training mostly uses static rule desensitization, which is difficult to identify implicit sensitive knowledge in complex context, and cannot meet the strict differential privacy budget constraint; second, the model training stage lacks dynamic perception and adaptive intervention mechanism for token-level privacy exposure, which may cause high-risk information in internal corpus to be remembered and reproduced by the model; third, the security protection in the inference stage is often limited to one-way input filtering or output keyword matching, which cannot effectively resist advanced attacks such as multi-modal prompt injection and role overreach, and the communication link is vulnerable to man-in-the-middle eavesdropping; in addition, the generated content generally lacks robust watermarking mechanism against editing and translation, which is difficult to support post-audit; finally, the terminal side compliance verification highly depends on cloud services, which cannot guarantee continuous compliance in offline or low-bandwidth scenarios. The above problems are particularly prominent in high-sensitive industries such as finance, government affairs and medical treatment, which seriously restricts the safe landing and large-scale application of AIGC technology, and an end-to-end, adaptive and systematic data protection scheme in line with national cryptographic standards is urgently needed. SUMMARY

[0005] The present application is to make up for the shortcomings of the prior art, and provides a data protection method and system for artificial intelligence generated content, which can effectively solve the problems in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: On one hand, a data protection system for AI-generated content, comprising the following components: a data governance subsystem, used for three-level governance of the original corpus: sensitive knowledge discovery, classification, and desensitization, outputting a memoryless training set that satisfies differential privacy budget constraints; a model training subsystem, bound to a Trusted Execution Environment (TEE), used to introduce a dynamic forgetting mechanism during the model training phase, calculating the privacy exposure of each token in real time and triggering a local gradient ascent forgetting algorithm; and a bidirectional streaming security gateway, connected in a transparent proxy manner to the front end of a large model inference cluster. The system is used to intercept malicious input commands, desensitize and block output content, and establish session-level encrypted channels during the inference phase; a semantic watermark embedding subsystem is used to embed invisible semantic watermarks into the final generated content, distributing traceability codes in the form of adversarial examples into the text embedding space; a blockchain auditing subsystem is used to write watermark hashes, user identifiers, and policy versions into timestamped transactions via a blockchain sidechain; and an edge white-box playback subsystem is used to employ edge computing white boxes in the terminal display stage, where content is first reviewed by a local AI auditing model before being projected onto the screen; all subsystems provide services to the outside world in a unified manner through an API gateway and support horizontal scaling.

[0007] Preferably, the data governance subsystem includes a sensitive knowledge discovery module, a hierarchical module, and a differential privacy desensitization module connected in sequence. The sensitive knowledge discovery module employs a knowledge graph-based entity-relation joint extraction model. This model uses a pre-constructed domain knowledge graph to jointly identify and extract named entities and semantic relationships between entities in the original corpus, achieving an accuracy rate of no less than 96%. The hierarchical module assigns a sensitivity level label to each corpus segment based on the extracted entity type and relationship strength, combined with preset sensitivity level classification rules. The differential privacy desensitization module adaptively allocates a differential privacy noise budget based on this sensitivity level label, applying stronger Laplace noise perturbations to highly sensitive segments to ensure that the final output training set satisfies the constraint that the overall differential privacy budget ε≤1.

[0008] Furthermore, the model training subsystem runs within a Trusted Execution Environment (TEE), and its dynamic forgetting mechanism includes a privacy exposure calculation unit and an adaptive forgetting trigger unit. For each token during training, the privacy exposure calculation unit calculates the frequency difference Δf between its occurrence in the public corpus and the internal corpus in real time, and multiplies this difference by a preset sensitivity coefficient λ to obtain the real-time privacy exposure P of that token. The adaptive forgetting trigger unit maintains a threshold θt that decays exponentially with the training round t, with the decay formula θt = θ0·e^(−kt), where θ0 is the initial threshold and k is the decay coefficient, ranging from [0.01, 0.05]. When the privacy exposure P of a token is higher than the threshold θt of the current round, the trigger unit initiates a local gradient ascent forgetting algorithm, applying a backward gradient to the subset of model parameters containing that token to weaken the model's memory of that sensitive information.

[0009] Furthermore, the bidirectional streaming security gateway is deployed in a Sidecar pattern, corresponding one-to-one with the model inference Pod, enabling zero-code intrusion access. This gateway includes an input filtering engine, an output filtering engine, and a national cryptographic communication module. The input filtering engine employs a dual-channel parallel operation of a multimodal intent recognition model and a rule engine. The multimodal intent recognition model is a neural network pre-trained based on image-text alignment and contrast learning, capable of simultaneously parsing malicious intent in text and image inputs. Its interception rate against prompt injection attacks is no less than 98.7%, and its false positive rate is no more than 1%. The output filtering engine integrates regular expression matching and a custom enterprise confidentiality pattern library, performing millisecond-level scanning and desensitization or blocking of personally identifiable information (PII), trade secrets, and prohibited content that may be contained in the model-generated content. The national cryptographic communication module establishes a session-level one-time password channel between the gateway and the backend large model using the national cryptographic SM9 identifier cryptography algorithm. A temporary identifier key IDtemp is generated for each inference request; the key's lifespan is strictly bound to a single request, and it expires immediately after the request ends.

[0010] Furthermore, the semantic watermark embedding subsystem achieves watermark embedding by optimizing the penultimate layer latent vector of the Transformer model. Its optimization objective function is defined as a weighted combination of minimizing the text perplexity PPL and maximizing the area under the receiver operating characteristic curve (AUC) of the watermark detector, i.e. ; Here, α is the balancing hyperparameter, determined by differentiable hyperparameter search (DART-style). The system encodes a 256-bit traceable code as an adversarial perturbation and fine-tunes the latent vector at selected locations using gradient descent, so that the watermark information is integrated into the semantic representation of the text in a statistically imperceptible way. This ensures that the watermark recovery rate can still reach 99% after the generated text has undergone secondary editing, translation, or compression.

[0011] On the other hand, the blockchain auditing subsystem and the semantic watermark embedding subsystem are asynchronously decoupled through the message queue Kafka, with a peak throughput of no less than 10,000 TPS. This system is compatible with mainstream blockchain platforms such as AntChain and ChangAnChain. After receiving the watermark hash, it packages it together with the user ID that initiated the request and the version number of the currently effective security policy, signs it using the national cryptographic SM2 algorithm, generates a transaction hash using the SM3 algorithm, and finally writes the timestamped transaction to the blockchain sidechain. The entire on-chain process has a latency of no more than 3 seconds.

[0012] Furthermore, the edge white-box playback subsystem includes a lightweight local AI review model and an offline compliance cache. The local AI review model employs depthwise separable convolution and knowledge distillation techniques for compression, resulting in a model size of no more than 50MB. It runs within the TrustZone security domain of an ARM architecture processor, ensuring the review logic is tamper-proof. This model can perform joint review of the text and image content to be projected using Optical Character Recognition (OCR) and Natural Language Processing (NLP), with a single-frame review latency of no more than 200 milliseconds. The offline compliance cache is automatically activated upon detecting a network interruption and can store and execute localized compliance review strategies for up to 24 hours.

[0013] On the other hand, a data protection method for AI-generated content includes the following steps: Step S110, performing sensitive knowledge discovery, classification, and desensitization on the original corpus to output a memoryless training set that satisfies the differential privacy budget ε≤1; Step S120, introducing a dynamic forgetting mechanism during the model training phase to calculate the privacy exposure of each token in real time. If the exposure is higher than an adaptive threshold θt that decays exponentially with the training round t, a local gradient ascent forgetting algorithm is triggered; Step S130, deploying a bidirectional streaming security gateway during the inference phase, wherein the gateway is connected to the front end of the large model inference cluster in a transparent proxy manner; Step S131, at the gateway input side, intercepting prompt injection and role-based attacks through a dual-channel multimodal intent recognition model and rule engine. Step S132: On the gateway output side, using regular expressions and enterprise-defined confidentiality patterns, perform millisecond-level desensitization or blocking of Personally Identifiable Information (PII), trade secrets, and prohibited content; Step S133: Between the gateway and the model, establish a session-level one-time password channel using the national cryptographic SM9 identifier cipher; Step S140: Embed an invisible semantic watermark into the final generated content, and distribute the 256-bit traceable code in the form of adversarial examples into the text embedding space; Step S150: Write the watermark hash, user ID, and policy version into a timestamped transaction through a blockchain sidechain; Step S160: In the terminal display stage, use an edge computing white box, where the content is first reviewed by a local AI model before being projected onto the screen, and enable offline compliance caching in the offline state.

[0014] Preferably, in step S110, sensitive knowledge discovery employs a knowledge graph-based entity-relation joint extraction model with an accuracy rate of no less than 96%. In step S120, privacy exposure is calculated by multiplying the frequency difference Δf of the token in the public and internal corpora by a preset coefficient λ. The decay of the threshold θt follows the formula θt=θ0·e^(−kt), where k∈[0.01,0.05]. In step S131, the multimodal intent recognition model is a graph-text alignment and contrast learning model with a prompt injection interception rate of no less than 98.7% and a false positive rate of no more than 1%. In step S133, the SM9 one-time secret channel uses a temporary identifier key IDtemp, whose lifespan is bound to a single inference request, and the key expires immediately after the request ends. In step S140, the implicit semantic watermark is achieved by optimizing the penultimate layer of the Transformer's implicit vectors, with the optimization objective being a weighted combination of minimizing the text perplexity PPL and maximizing the watermark detection AUC. In step S150, the blockchain sidechain is compatible with AntChain and Chang'an Chain, and uses the national cryptographic SM2 algorithm for signing and the SM3 algorithm for hashing, with an on-chain latency of no more than 3 seconds. In step S160, the local AI review model size does not exceed 50MB, runs within the ARMTrustZone security domain, and the latency for single-frame OCR and NLP joint review does not exceed 200 milliseconds.

[0015] Furthermore, each step in the method is deployed through a containerized microservice architecture, and each service supports multi-tenant resource isolation under the Kubernetes orchestration engine. The overall solution complies with the relevant requirements of the "Interim Measures for the Administration of Generative Artificial Intelligence Services".

[0016] Compared with existing technologies, this invention has the following beneficial effects: 1. By combining a three-level governance system of "sensitive knowledge discovery - hierarchical classification - differential privacy desensitization" with a token-level dynamic forgetting mechanism during the training phase, end-to-end privacy protection from the data source to model parameters is achieved, effectively preventing implicit sensitive knowledge from being memorized and reproduced by the model, and meeting strict differential privacy budget constraints. 2. The bidirectional streaming security gateway integrates multimodal intent recognition, real-time content filtering, and national cryptographic one-time password communication, providing comprehensive protection against high-level attacks (such as multimodal hint injection and man-in-the-middle eavesdropping), significantly improving the security of the inference process. 3. The fusion of implicit semantic watermarking optimized based on adversarial examples and blockchain auditing provides robust traceability capabilities against editing and translation of generated content, achieving accuracy and immutability of post-audit, and solving the problem of difficulty in tracing content abuse. 4. The lightweight AI review white-box and offline caching mechanism at the edge ensures continuous compliance of terminal display in offline or weak network environments, reduces absolute dependence on cloud services, and expands applicability in highly sensitive scenarios. 5. The system adopts containerized microservices and cloud-native architectures such as Sidecar, achieving zero-business-intrusive access, high scalability, and multi-tenant isolation, ensuring the solution's large-scale deployment capabilities and operational efficiency. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall technical architecture of a data protection method and system for artificial intelligence-generated content proposed in this invention; Figure 2 This is a schematic diagram of the core principle framework for end-to-end privacy protection in the data governance and model training stages of this invention. Detailed Implementation

[0018] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the following detailed description is provided in conjunction with the accompanying drawings and preferred embodiments, based on specific implementation methods of the present invention.

[0019] Example 1: Deploying large-scale generative AI services in highly sensitive industries such as finance, healthcare, and government presents severe data security and compliance challenges. For example, in financial intelligent customer service scenarios, model training corpora may contain sensitive information such as un-anonymized customer transaction records and internal risk assessment reports; in inference services, users may use carefully crafted prompts to induce the model to disclose trade secrets or generate inappropriate content; once generated content is maliciously altered or misused, tracing its source is extremely difficult. This invention provides a data protection method and system for AI-generated content, aiming to build a comprehensive, multi-dimensional security protection system covering data governance, model training, inference services, content tracing, and terminal playback.

[0020] SeeFigure 1 The overall architecture of this system includes a data governance subsystem, a model training subsystem, a bidirectional streaming security gateway, a semantic watermark embedding subsystem, a blockchain auditing subsystem, and an edge white-box playback subsystem. All subsystems provide standardized service interfaces to the outside world through a unified API gateway and are deployed based on a containerized microservice architecture. They support horizontal scaling and multi-tenant resource isolation under the Kubernetes orchestration engine, ensuring high availability and elastic scalability of the system.

[0021] The data governance subsystem is the first line of defense for ensuring data source security. This subsystem comprises a sensitive knowledge discovery module, a hierarchical module, and a differential privacy desensitization module, connected sequentially. The core of the sensitive knowledge discovery module is a knowledge graph-based entity-relation joint extraction model. During the training phase, this model utilizes a pre-built knowledge graph covering fields such as finance, healthcare, and law, containing millions of entity nodes and tens of millions of relation edges. The model employs a structure combining graph neural networks and a Transformer encoder, enabling end-to-end semantic parsing of the input raw corpus. When processing a text, the model first performs word segmentation and word vector mapping, then inputs the word sequence into the encoder to generate context-relevant semantic representations. Subsequently, the entity recognition head and relation classification head in the model work in parallel. The entity recognition head is responsible for identifying and locating named entities in the text, such as names, ID numbers, bank card numbers, disease names, drug names, and government document numbers; the relation classification head, based on the contextual semantics between entities, determines and extracts predefined relationships between them, such as "someone - suffers from - a certain disease" or "an account - has - a certain transaction". The joint extraction model achieves an overall recognition accuracy of no less than 96% on the internal test set, effectively discovering sensitive knowledge fragments hidden in complex sentence structures and unstructured text.

[0022] The grading module receives a list of entity and relation triples output by the sensitive knowledge discovery module. This module has a built-in configurable sensitivity level classification rule base. The rule base assigns a sensitivity level label to each identified corpus fragment based on entity type, relation type, and the combination of entities in a specific context. Sensitivity levels are typically divided into multiple levels; for example, L0 is public information, L1 is general internal information, L2 is sensitive personal information, and L3 is core trade secrets or top-secret information. The assignment process considers not only the entities themselves but also the strength of the relations; for example, a "disclosure-amount" relation may have a higher sensitivity than a "mention-product" relation. Each original corpus fragment is ultimately segmented into multiple fragments, each with a specific sensitivity level label.

[0023] The differential privacy desensitization module is the final output of data governance. Based on the sensitivity level labels provided by the grading module, this module adaptively allocates a differential privacy noise budget to each corpus segment. Its core mechanism is that segments with high sensitivity levels are allocated a smaller privacy budget, meaning stronger noise perturbation is applied to provide higher privacy protection; segments with low sensitivity levels can be allocated a relatively larger budget to preserve data usability as much as possible while protecting privacy. The noise addition process involves directly applying Laplace-distributed noise to numerically sensitive information in the text; for non-numerical categorical information or text segments, a differential privacy method based on an exponential mechanism is used to randomly select from a set of perturbed candidate outputs. Through rigorous budget accumulation calculations, this module ensures that the entire training dataset, after merging all processed corpus segments, satisfies the strict constraint that the overall differential privacy budget ε≤1. Finally, this module outputs a memoryless training set that meets differential privacy requirements. Sensitive information in this dataset has been effectively masked by statistically significant noise, greatly reducing the risk of the model directly memorizing and reproducing the original sensitive data.

[0024] See Figure 2 The model training subsystem is tightly integrated with the data governance subsystem, and its unique feature lies in its operating environment and internal mechanisms. This subsystem is forcibly deployed and runs within a hardware-level trusted execution environment. This trusted execution environment physically isolates a protected memory region through specific security instruction sets of the CPU. Code and data within this region undergo integrity checks during loading and cannot be spied on or tampered with by the host operating system or other applications during runtime. This ensures the confidentiality and integrity of the model training algorithm and training data, especially anonymized intermediate data, during the computation process.

[0025] Within the trusted execution environment, the model training subsystem introduces a dynamic forgetting mechanism within the standard gradient descent training loop. This mechanism is implemented collaboratively by a privacy exposure calculation unit and an adaptive forgetting trigger unit. The privacy exposure calculation unit's job is to assess the potential privacy exposure risk of each lexical unit during training in real time and with fine granularity. Its calculation method involves maintaining a word frequency statistics table for a public corpus and a word frequency statistics table for an internal corpus. For each lexical unit appearing in the current training batch, the unit queries the frequency of that lexical unit in both corpora in real time and calculates the difference Δf. The larger the difference Δf, the higher the frequency of that lexical unit in the internal corpus compared to the public corpus, and the greater the likelihood that it carries sensitive internal information. Subsequently, this difference is multiplied by a preset sensitivity coefficient λ, the value of which can be adjusted according to the type of lexical unit; for example, proper nouns and medical terms correspond to higher λ values. Finally, the real-time privacy exposure P of that lexical unit in the current training step is obtained.

[0026] The adaptive forgetting trigger unit is responsible for dynamically adjusting the forgetting threshold based on the training progress. This unit maintains a threshold θt that decays exponentially with the training epoch t. Its decay follows the formula θt = θ0 · e^(−kt). Here, θ0 is the initial threshold, typically set at a high level to allow the model to learn a wide range of features in the early stages of training; k is the decay coefficient, strictly limited to the range [0.01, 0.05] to ensure a gradual decrease in the threshold. As the number of training epochs increases, the threshold θt gradually decreases, meaning the system's tolerance for privacy exposure decreases, and the forgetting mechanism becomes more sensitive and stringent.

[0027] In each training round, when the privacy exposure calculation unit reports that the privacy exposure P of a certain vocabulary unit is higher than the adaptive threshold θt of the current round, the adaptive forgetting trigger unit is immediately activated. It does not stop the training of the entire model, but precisely initiates the local gradient ascent forgetting algorithm. This algorithm first locates the subset of parameters in the model most closely associated with the currently high-exposure vocabulary unit; these parameters are typically located in the model's embedding layers or the projection matrix of a specific attention head. Then, for these selected parameters, the algorithm calculates and applies a backward gradient, opposite to the direction of the standard training gradient. The strength of this backward gradient is proportional to the degree to which the privacy exposure P exceeds the threshold θt. In this way, the model's memory of the sensitive vocabulary unit is actively and locally weakened, equivalent to performing a "directed forgetting" at the model parameter level, thereby further consolidating the privacy protection effect at the parameter level. This forms a double guarantee, echoing the differential privacy desensitization in the data governance stage.

[0028] The bidirectional streaming security gateway is a core component for protecting against security threats during the inference phase. Deployed in a sidecar pattern, this gateway corresponds one-to-one with each large model inference instance, acting as a transparent proxy between user requests and the model service. This deployment method achieves zero intrusion into business code, meaning that complete security capabilities can be added without modifying the original large model inference code. Internally, the gateway includes an input filtering engine, an output filtering engine, and a national cryptographic communication module, forming a bidirectional, streaming processing pipeline.

[0029] The input filtering engine is responsible for intercepting malicious user requests. It employs a dual-channel parallel architecture consisting of a multimodal intent recognition model and a rule engine. The multimodal intent recognition model is a deep neural network pre-trained based on image-text alignment and contrast learning. During training, this model uses massive amounts of image-text pair data, learning to map images and text to a unified semantic space, thus enabling it to simultaneously understand the implicit intent in text prompts and uploaded images. During runtime, for plain text input by the user, the model analyzes its syntactic structure and deep semantics; for user-uploaded images, the model first extracts features and then combines them with text prompts for analysis. The model can accurately identify multimodal malicious intents such as prompt injection attacks, malicious role-playing inducements, and unauthorized data access commands. The model achieves an interception rate of no less than 98.7% against complex prompt injection attacks, while through extensive negative sample training and threshold optimization, the false positive rate is controlled below 1%, ensuring a normal user experience for legitimate users. The rule engine, as a supplement, has a built-in hard rule library targeting known attack patterns, such as blacklist keyword matching and abnormal request frequency limits, providing another layer of deterministic assurance for interception.

[0030] The output filtering engine is responsible for real-time security checks and processing of the content generated by the model. This engine integrates a high-performance regular expression matching engine and a confidentiality pattern library that enterprises can flexibly customize according to their needs. The confidentiality pattern library includes various types of sensitive patterns, including personally identifiable information patterns, trade secret patterns, and patterns for prohibited content explicitly forbidden by laws and regulations. Personally identifiable information patterns can identify ID card numbers, mobile phone numbers, bank card numbers, addresses, etc.; trade secret patterns can match based on keywords and document fingerprints provided by the enterprise. The engine performs millisecond-level character-by-character scanning of the text stream output by the model. Once any sensitive pattern is detected, it immediately executes actions according to preset policies: for personally identifiable information, it typically performs de-identification processing; for core trade secrets or prohibited content, it directly blocks the output and returns a security interception alarm to the gateway. The entire scanning and processing process has extremely low latency and does not affect the normal streaming output experience.

[0031] The national cryptographic communication module ensures the security of the transmission channel between the gateway and the backend large-scale model inference service. This module employs the national cryptographic SM9 identifier cryptography algorithm. At the start of each inference session, the gateway generates a temporary identifier key IDtemp based on the unique identifier of the current request. Using the SM9 algorithm, the communicating parties do not need to exchange keys beforehand; they can derive the encryption key for the current session based on the other party's identifier and the system master key. The lifespan of this temporary key IDtemp is strictly bound to a single inference request. The key is generated when the request is established and used to encrypt all uplink request and downlink response data streams; after the request is processed and the connection is closed, the temporary key is immediately destroyed in memory and cannot be reproduced. This "one-time key" mechanism effectively resists threats such as network eavesdropping and replay attacks; even if the key for one session is cracked, it will not jeopardize the security of other sessions.

[0032] The semantic watermarking embedding subsystem operates at the final output stage of the model-generated content, embedding an imperceptible but robust traceable identifier. The core technology of this subsystem is to embed the watermark by optimizing the penultimate latent vector of the Transformer model during text generation. Specifically, the system uses a 256-bit traceable code as the information to be embedded. This traceable code can encode information such as the source model identifier, user session identifier, and timestamp. The embedding process is constructed as an optimization problem: the system selects a key position in the generated text and fine-tunes the latent vector corresponding to that position using gradient descent. The objective function L is defined as a weighted combination of minimizing the text perplexity and maximizing the area under the receiver operating characteristic curve (AUC) of the watermark detector, i.e., L = L / L. Here, α is a balancing hyperparameter used to adjust the trade-off between watermark concealment and detectability. Minimizing text perplexity ensures that the introduction of the watermark does not significantly reduce the fluency and semantic quality of the generated text, making it difficult for the human eye or ordinary detection tools to detect anomalies; maximizing AUC ensures that the watermark detector can extract watermark information from the text with high confidence. Through this adversarial optimization, the 256-bit traceability code is transformed into subtle perturbations, distributed and fused into the deep semantic representation space of the text. Experiments show that the watermark embedded in this method still achieves a recovery rate of 99% after the generated text undergoes common secondary editing, translation between different languages, and format compression, demonstrating extremely strong robustness.

[0033] The blockchain auditing subsystem provides tamper-proof evidence storage and audit traceability capabilities for generated content embedded with watermarks. This subsystem is asynchronously decoupled from the semantic watermark embedding subsystem via a high-throughput message queue, with a peak processing capacity of no less than 10,000 transactions per second. Once the semantic watermark embedding subsystem successfully embeds a watermark into generated content, it immediately calculates the joint hash value of the content and the watermark information and sends this hash value as core audit data to the message queue. The blockchain auditing subsystem, acting as a consumer, retrieves data from the queue. The system is designed to be compatible with mainstream blockchain platforms. In its implementation, upon receiving the watermark hash, the system packages it together with the user identity of the initiator of the inference request and the version number of the current system's security policy to form a transaction data to be uploaded to the blockchain. Subsequently, the transaction data is signed using the SM2 elliptic curve digital signature algorithm to ensure the authenticity and integrity of the transaction's origin. Then, the hash value of the entire transaction package is calculated using the SM3 cryptographic hash algorithm, serving as the unique identifier of the transaction on the blockchain. Ultimately, the transaction, digitally signed and timestamped, was submitted and written into a new block on the blockchain sidechain. The entire process, from receiving the data to completing the on-chain entry, had an end-to-end latency of no more than 3 seconds, meeting the requirements for real-time auditing. Once the information is on the chain, due to its distributed ledger and cryptographic guarantees, no single entity can tamper with or delete the record, thus providing irrefutable evidence for retrospective investigation of content misuse.

[0034] The edge white-box playback subsystem is the final link in the security chain, ensuring the compliance of content displayed on end-user terminals. This subsystem primarily consists of a lightweight local AI review model and an offline compliance cache. The local AI review model employs depthwise separable convolution and knowledge distillation techniques for compression optimization, resulting in a final model size of no more than 50MB, making it ideal for deployment on resource-constrained edge devices. This model is deployed and runs within the TrustZone security domain of the terminal device's ARM architecture processor. TrustZone is a hardware-provided secure isolation environment that ensures the review model's code and operational logic cannot be tampered with by ordinary applications or malware on the terminal, guaranteeing the reliability of the review results.

[0035] During playback, any text or image content that needs to be projected is first processed by a local AI review model before final rendering. This model has the capability of joint review using optical character recognition (OCR) and natural language processing (NLP). For images, it first performs OCR to extract textual information; for text, it directly performs semantic analysis. The model can identify whether the content contains residual sensitive information that was not completely blocked in the output filtering engine, and whether it complies with localized content security policies. The complete review latency for a single frame is controlled within 200 milliseconds, making the wait virtually imperceptible to the user. Only content that passes the review is sent to the display buffer for projection.

[0036] The offline compliance caching mechanism is a disaster recovery design for scenarios with unstable or completely interrupted networks. When the edge white-box playback subsystem detects a loss of network connection with the cloud service, it automatically switches to offline mode. The offline compliance cache pre-stores a set of independently executable localized compliance review policies and necessary model parameters. In offline mode, the local AI review model will work according to the cached policies to ensure uninterrupted content review. This cache is typically designed to support the system to run continuously and perform localized compliance reviews for up to 24 hours in a network outage, greatly reducing the system's absolute dependence on cloud services and expanding its applicability in highly sensitive or weak network scenarios such as military and field operations.

[0037] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A data protection system for AI-generated content, characterized in that, The system includes the following components: The data governance subsystem is used to perform three-level governance of the raw corpus: sensitive knowledge discovery, classification, and desensitization, and outputs a memoryless training set that meets the differential privacy budget constraint. The model training subsystem, bound to a trusted execution environment, is used to introduce a dynamic forgetting mechanism during the model training phase and to calculate the privacy exposure of each vocabulary unit in real time. A bidirectional streaming security gateway is connected in series with the front end of a large model inference cluster in a transparent proxy manner. It is used to intercept malicious input commands, de-identify and block output content, and establish a session-level encrypted channel during the inference phase. The semantic watermarking embedding subsystem is used to embed an invisible semantic watermark into the final generated content, and distributes the traceability code into the text embedding space in the form of adversarial examples. The blockchain auditing subsystem is used to write watermark hashes, user identifiers, and policy versions into timestamped transactions via the blockchain sidechain. The edge white-box playback subsystem is used to employ edge computing white boxes in the terminal display stage.

2. The data protection system for AI-generated content according to claim 1, characterized in that: The data governance subsystem includes a sensitive knowledge discovery module, a hierarchical module, and a differential privacy desensitization module connected in sequence. The sensitive knowledge discovery module uses a knowledge graph-based entity-relation joint extraction model to jointly identify and extract named entities and semantic relationships between entities in the original corpus. The hierarchical module assigns a sensitivity level label to each corpus segment based on the extracted entity type and relation strength. The differential privacy desensitization module adaptively allocates a differential privacy noise budget based on the sensitivity level label and applies Laplace noise perturbation to highly sensitive segments.

3. The data protection system for AI-generated content according to claim 1, characterized in that: The dynamic forgetting mechanism includes a privacy exposure calculation unit and an adaptive forgetting triggering unit. The privacy exposure calculation unit calculates the difference Δf between the frequency of each word unit in the public corpus and the internal corpus in real time, and multiplies the difference by a preset sensitivity coefficient λ to obtain the real-time privacy exposure P of the word unit. The adaptive forgetting triggering unit maintains a threshold θt that decays exponentially with the training round t. The decay follows the formula θt=θ0·e^(−kt), where θ0 is the initial threshold and k is the decay coefficient. When the privacy exposure P of a word unit is higher than the threshold θt of the current round, the adaptive forgetting triggering unit starts the local gradient ascent forgetting algorithm.

4. The data protection system for AI-generated content according to claim 1, characterized in that: The bidirectional streaming security gateway includes an input filtering engine, an output filtering engine, and a national cryptographic communication module. The input filtering engine uses a multimodal intent recognition model and a rule engine to work in parallel to intercept malicious intent. The output filtering engine integrates regular expression matching and an enterprise-defined confidential pattern library to scan and process the content generated by the model. The national cryptographic communication module uses the national cryptographic SM9 identifier cryptographic algorithm to establish a session-level one-time password channel.

5. The data protection system for AI-generated content according to claim 1, characterized in that: The semantic watermark embedding subsystem achieves watermark embedding by optimizing the penultimate layer latent vector of the Transformer model. Its optimization objective function is defined as a weighted combination of minimizing the text perplexity PPL and maximizing the area under the receiver operating feature curve (AUC) of the watermark detector. , where α is the equilibrium hyperparameter.

6. The data protection system for AI-generated content according to claim 1, characterized in that: The content of the edge white-box playback subsystem is first reviewed by a local AI review model before being projected onto the screen. The edge white-box playback subsystem includes a lightweight local AI review model and an offline compliance cache. The local AI review model runs within the TrustZone security domain of the ARM architecture processor. The subsystem provides services to the outside world in a unified manner through an API gateway.

7. The data protection system for AI-generated content according to claim 1, characterized in that, At the start of each inference session, the national cryptographic communication module generates a temporary identification key IDtemp based on the unique identifier of the current request. The lifespan of the temporary identification key IDtemp is strictly bound to a single inference request.

8. The data protection system for AI-generated content according to claim 1, characterized in that, The blockchain auditing subsystem uses the national cryptographic SM2 algorithm to sign transaction data containing watermark hashes, user identity identifiers, and security policy version numbers, and uses the national cryptographic SM3 algorithm to generate transaction hashes.

9. The data protection system for AI-generated content according to claim 1, characterized in that, The local AI review model uses depthwise separable convolution and knowledge distillation techniques for compression, and can perform joint review of the text and image content to be projected on the screen using optical character recognition and natural language processing.

10. A data protection method for artificial intelligence-generated content, characterized in that, The method includes the following steps: S110 performs three-level governance on the original corpus: sensitive knowledge discovery, classification, and desensitization, and outputs a memoryless training set that satisfies the differential privacy budget ε≤1. The sensitive knowledge discovery adopts an entity-relation joint extraction model based on knowledge graph. The classification assigns sensitivity level labels to corpus fragments according to the extracted entity type and relation strength. The desensitization adaptively allocates the differential privacy noise budget according to the sensitivity level labels. S120, In the model training phase, a dynamic forgetting mechanism is introduced to calculate the privacy exposure of each word unit in real time. The privacy exposure is obtained by calculating the difference in the frequency of occurrence of the word unit in the public corpus and the internal corpus Δf and multiplying it by a preset coefficient λ. If the exposure is higher than the adaptive threshold θt that decays exponentially with the training round t, the local gradient ascent forgetting algorithm is triggered. S130, Deploy a bidirectional streaming security gateway during the inference phase. The gateway is connected in series with the front end of the large model inference cluster in a transparent proxy manner. S131, on the gateway input side, uses a dual-channel approach of multimodal intent recognition model and rule engine to intercept prompt injection, role-playing, and unauthorized commands; S132, on the gateway output side, uses regular expressions and enterprise-defined confidentiality patterns to desensitize or block personally identifiable information, trade secrets, and prohibited content; S133, a session-level one-time key channel is established between the gateway and the model using the national cryptographic SM9 identifier password; S140, embed an invisible semantic watermark into the final generated content, and distribute the traceability code into the text embedding space in the form of adversarial examples. The invisible semantic watermark is achieved by optimizing the penultimate layer of the Transformer hidden vector. The optimization objective is to minimize the text perplexity PPL and maximize the watermark detection AUC. S150, the watermark hash, user ID, and strategy version are written into a timestamped transaction via a blockchain sidechain; The S160 uses an edge computing white box for terminal display. Content is first reviewed by a local AI model before being projected onto the screen, and offline compliance caching is enabled when the network is disconnected.

Images